The Hospitality Register That Nobody Reads

The controls exist on paper but are not operating effectively. The hospitality register lacks the data needed to judge risk: attendee names, official status, purpose, and business benefit are missing, and there is no aggregate review by official or project. Approval by the country manager who also owns the sales budget creates a conflict, and the USD 500 threshold is not risk-based. Training completion of 96% and an average quiz score of 92% are output measures; supervisors telling staff to 'just sign the sheet' and the engineer's comment show that the desired behavior is not embedded. The hotline lacks independence, and closing three reports in two days suggests triage or suppression rather than investigation. Third-party clauses without audit or termination rights are weak. For the board report, I would separate design gaps from operating failures, cite the evidence, and avoid concluding that the controls are effective merely because they are documented.

I would treat this as a potential red flag, not automatically as bribery. First, establish the facts: who attended, their roles and decision-making authority over current projects, the purpose and venue, whether a decision was pending, who paid, and how it was recorded. Check related hospitality and project records for a pattern. Escalate to the ABMS owner and, given public officials, seek legal advice on disclosure. Suspend the country manager's hospitality approval authority pending review and have the matter assessed independently. If the dinner was disproportionate or intended to influence a decision, apply consequence management and consider self-reporting. If it was legitimate but poorly documented, correct the approval and recording process. Either way, the root cause is likely an approval design that lets the commercial owner authorize their own team's spending; corrective action should change the control, not just remind staff.

Completion is not effectiveness. ISO 37001 expects people to be competent for their roles and aware of the policy, their responsibilities, and the consequences of non-compliance. A 20-minute module with a quiz can raise awareness, but it does not prove that high-risk staff can recognize a red flag or resist pressure. I would advise role-based training for sales, project, procurement, and finance staff, using realistic scenarios and requiring a pass mark or manager sign-off. Measure behavior through audits of hospitality and third-party files, spot checks, and interviews. Track leading indicators such as quality of approvals, overdue due diligence, and speak-up reports, and feed them to management review. The site evidence shows a culture problem that training completion will not fix. The CEO should fund competence assessment and address incentives and supervision, not celebrate a completion statistic.